Brinqa, an Austin-based exposure management company, acquired PlexTrac, a Boise, Idaho, startup whose software penetration testers and red teams use to report findings and retest fixes. The companies announced the deal on 19 August 2026.
Financial terms were not disclosed. Law firm Covington & Burling represented Brinqa in the transaction.
PlexTrac will keep operating as a standalone product, and existing customers can choose to extend into Brinqa's wider platform. PlexTrac founder Dan DeCloss, its chief customer brand officer, joins Brinqa's executive leadership team and board to lead the combined offensive security practice.
What PlexTrac built
PlexTrac sells an AI-powered platform for pentest reporting and threat exposure management. It collects data from security tools, streamlines the writing of reports, prioritises risk and automates remediation workflows. Customers named in the announcement include Expedia, Royal Caribbean, Mandiant and Deloitte.
DeCloss founded the company in 2018, according to SiliconANGLE. In its 2022 funding announcement PlexTrac said it had quadrupled its headcount and tripled recurring revenue in 2021, but it did not disclose a current headcount alongside the acquisition.
When it raised its Series B, PlexTrac said its platform served consultants, service providers and in-house enterprise teams, pulling data from tools such as vulnerability scanners and breach and attack simulators and automating the workflows needed to report on it.
“PlexTrac was built by offensive security practitioners, for offensive security practitioners, and that's not changing.”
Why Brinqa is buying
Brinqa, founded in 2009, pulls in findings from scanners, cloud accounts and application security tools and ranks which exposures an organisation should deal with first. What it lacked was a way to show that a fix had worked. Brinqa said PlexTrac closes that gap in the continuous threat exposure management (CTEM) cycle.
Testing will now sit at both ends of remediation: before, to confirm that an exposure can really be exploited, and after, to confirm that the fix held. Every confirmed exploit and fix recorded in PlexTrac will feed Brinqa's Cyber Risk Graph data layer and the AI agents that use it, including models customers connect through its Bring Your Own AI programme.
Chief executive Dan Pagel said the pairing gives customers proof they can defend to a board, an auditor or an AI system acting on the data. A vulnerability marked closed in a ticketing system is only a status update, the companies argued, while one confirmed closed by a retest is evidence.
For PlexTrac customers, the companies said, pentest teams and their workflows will now plug directly into a CTEM programme instead of sitting next to one, and Brinqa's prioritisation engine will point pentest resources at the exposures that matter most to the business. Security, IT and offensive security teams are meant to work from one prioritised list.
The combined company
Brinqa said the combined business has more than 3,000 customers in 57 countries, including more than a quarter of the Fortune 500, and called itself the largest standalone vendor in unified exposure management. Both companies were named in Gartner's first Magic Quadrant for Exposure Assessment Platforms.
Brinqa reported 164% year-over-year growth in new bookings in 2025 and a 32% rise in the average selling price for new customers. In 2026, it said, new-logo bookings have more than doubled year over year. Its customers include Nestlé, PhonePe, Cambia Health Solutions, Guidewire and SAP.
Over the past year Brinqa has added AI features including Model Context Protocol interfaces, an AI Attribution Agent and an AI Deduplication Agent. It said validated findings from PlexTrac will make the data those tools rely on more reliable.
The founders and the funding
The two companies share an investor. Insight Partners led Brinqa's $110 million growth round in June 2021, Dealroom reported, and also led PlexTrac's $70 million Series B in February 2022. Existing investors Madrona Venture Group, Noro-Moseley Partners and StageDotO Ventures joined that round, which followed a $10 million Series A in April 2021.
Thomas Krane, a managing director at Insight Partners and a Brinqa board member, said exposure management only matters if teams can prove that a fix worked.
DeCloss said joining Brinqa gives the PlexTrac team a bigger platform to show that hands-on offensive security expertise still matters as more of the work is automated.
